fix issues with Nova security groups and Quantum

bug #1039400

- make quantumv2/api.py fetch actual DHCP server address, which
is needed by firewall layer (otherwise, the gateway IP is
incorrectly used and all DHCP traffic is dropped).
- add missing call from quantumv2/api.py to the security
groups API when a VM is allocated/deallocated.

- Add a vif-driver that is a hybrid of the existing Open vswitch +
linux bridge drivers, which allows OVS quantum plugins to
be compatible with iptables based filtering, in particular, nova
security groups.

- Also clean-up some docstrings in virt/libvirt/vif.py

Change-Id: I7cf5cf09583202a12785b616d18db3ee4bbffee0
Fix instances query for compute stats

Fix the query the compute resource stats generation uses to filter out
deleted instances.

bug 1046431

Change-Id: I634020d798a23ff5da97aaf9172b403005c1bd1a
Speed up creating floating ips.

Previously, we would make two separate DB calls for each floating ip
we created in floating_ip_bulk_create. This was just a little slow
(several hours to create a /16). This patch speeds up floating ip
creation just a little:

$ time bin/nova-manage floating create --ip_range=10.250.0.0/16

real	0m48.766s
user	0m34.342s
sys	0m1.984s

Resolves bug 1023560.

Change-Id: Ie3663440d414b102111178899db0c571769edba8
Allow admins to de-allocate any floating IPs

Fix bug 1045508

Change-Id: Ie5be3748c16a592209934cc85777f534e84842bc
Escape ec2 XML error responses

Fixes bug 978439

XML error responses to ec2 calls include user supplied data that is not
escaped. This could result in returning invalid XML.

This is addressed by using utils.xhtml_escape() on purposeful eC2 error
responses and when handling webob.exc.HTTPException.

Extended the tests for utils.xhtml_escape() to cover '&', '>', '<' and a tag
look-alike. These conversions are implicit to saxutils.escape().

Change-Id: Icb3e861c6c06c0d9c3b9e2ab1a658581a0fb39c6
Yield to another greenthread when some time-consuming task finished.

Partially addresses bug #1045152

On a heavily loaded compute node, it can be observed that periodic tasks
take so long to run that the report_state() looping call can be blocked from
running long enough that the scheduler thinks the host is dead.

Reduce the chance of this happening by yielding to another greenthread
after each periodic task has completed and each loop in some methods
that has linear relationship with the number of instances.

Change-Id: If2b125708da8298b20497e2e08e52280c102f1e1
Fix simple_tenant_usage's handing of future end times

Fixes bug #1043999

simple_tenant_usage returns the usage in the range between the supplied
start and end query parameters. The _hours_for() method calculates the
number of hours the instance was running in this range, even if the end time
is in the future.

By default, python-novaclient requests usage between 4 weeks ago and tomorrow.
This means we a report which accounts for 24 hours of extra running time for
each currently running instance. Fix this by clamping the period of the
returned report at the current time.

Change-Id: I61c211fd85b729aaeaac6ef24644ee19eb5bb6b0
Sync some updates from openstack-common

Syncs the latest code from the stable/folsom branch.

Includes:

  5a56539 Allow non-string items in the creds dict.
  769ec65 Don't trap then re-raise ImportError.
  202b8b7 Fix spelling typos

Change-Id: I6473358c743ce77b90dfb1282f3e257e6fd3dbf6
Use bare container format by default

Set container_format to bare during libvirt snapshot, when VM image in
glance was deleted. Currently, if VM image in glance was already deleted
before snapshot, nova will attempt to create snapshot image with
container_format: None. This cause glance to return error on attempt to
upload snapshot. According to glance docs container_format is not used
anywhere in glance or nova explicitly and it is safe to set it to bare,
when you are unsure which container_format you need to use.
Current snapshot logic sets snapshot disk_format to currently used
image_format in absence of base image in glance.

This resolves bug 921774 without need for snapshot mechanism redesign.

Change-Id: I7beea35120aaeac0837daecdf58f38f62e24454c
Merge "Yield to another greenthread when some time-consuming task finished."
Add scope to extra_specs entries

Do to conflicts between different scheduler filters it is necessary
to allow an optional scope for the different keys.  This scope is a
leading string followed by a ':' character, e.g.:

        foo:bar

is the `bar' entry with scope `foo'.

The Trusted filter will now use the scope `trust' and the
AggregateInstanceExtraSpecs and ComputeCapabilities filters will
check against any unscoped keys in the `extra_specs' table.
Any new filters that utilize the `extra_specs' table will need to
use a unique scope string for any keys they require.

Resolves bug 1039386

Change-Id: I2466dc3d4de8e9aeb76b294eeda1c939c0413366
Signed-off-by: Don Dugger <donald.d.dugger@intel.com
Merge "Sync some updates from openstack-common"
Merge "Use bare container format by default"
Merge "fix issues with Nova security groups and Quantum"
Merge "Fix instances query for compute stats"
Merge "Add scope to extra_specs entries"
Fix typo in simple_tenant_usage tests

Simple s/futrue/future/ typo fix

Change-Id: I110205c2392075ac8b7f7e423e466e1a6fbfab64
Merge "Allow admins to de-allocate any floating IPs"
Merge "Escape ec2 XML error responses"
Merge "Speed up creating floating ips."